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Abstract — In this work, the role of noisy feedback in enhancing 
the secrecy capacity of the wiretap channel is investigated. A 
model is considered in which the feed-forward and feedback 
signals share the same noisy channel. More specifically, a discrete 
memoryless modulo-additive channel with a full-duplex destina- 
tion node is considered first, and it is shown that a judicious 
use of feedback increases the perfect secrecy capacity to the 
capacity of the source-destination channel in the absence of 
the wiretapper. In the achievability scheme, the feedback signal 
corresponds to a private key, known only to the destination. Then 
a half-duplex system is considered, for which a novel feedback 
technique that always achieves a positive perfect secrecy rate 
(even when the source-wiretapper channel is less noisy than the 
source-destination channel) is proposed. These results hinge on 
the modulo-additive property of the channel, which is exploited 
by the destination to perform encryption over the channel without 
revealing its key to the source. 

I. Introduction 

Wyner introduced the wiretap channel in [ 1 ] and established 
the possibility of creating an almost perfectly secure source- 
destination link without relying on private (secret) keys. In the 
wiretap channel, both the wiretapper and destination observe 
the source encoded message through noisy channels, while 
the wiretapper is assumed to have unlimited computational re- 
sources. Wyner showed that when the source-wiretapper chan- 
nel is a degraded version of the source-destination channel, the 
source can send perfectly secure messages to the destination 
at a non-zero rate. The main idea is to hide the information 
stream in the additional noise impairing the wiretapper by 
using a stochastic encoder which maps each message to many 
codewords according to an appropriate probability distribution. 
By doing this, one induces maximal equivocation at the 
wiretapper By ensuring that the equivocation rate is arbitrarily 
close to the message rate, one achieves perfect secrecy in 
the sense that the wiretapper is now limited to learn almost 
nothing about the source-destination messages from its ob- 
servations. Csisiar and Korner generalized Wyner's approach 
by considering the transmission of confidential messages over 
broadcast channels [2]. This work characterized the perfect 
secrecy capacity of the Discrete Memoryless Channel (DMC), 
and showed that the perfect secrecy capacity is positive unless 
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the source-wiretapper channel is less noisy than the source- 
destination channel (referred to as the main channel in the 
sequel). 

Positive secrecy capacity is not always possible to achieve 
in practice. In an attempt to transmit messages securely in 
these unfavorable scenarios, [3] and [4] considered the wiretap 
channel with noiseless feedback (The authors also considered 
a more general secret sharing problem.). These works showed 
that one may leverage the feedback to achieve a positive 
perfect secrecy rate, even when the feed-forward perfect 
secrecy capacity is zero. In this model, there exists a separate 
noiseless public channel, through which the transmitter and 
receiver can exchange information. The wiretapper is assumed 
to obtain a perfect copy of the messages transmitted over this 
public channel. Upper and lower bounds were derived for the 
perfect secrecy capacity with noiseless feedback in [3], [4]. 
In several cases, as discussed in detail in the sequel, these 
bounds coincide. But, in general, the perfect secrecy capacity 
with noiseless feedback remains unknown. 

Our work represents a marked departure from the public 
discussion paradigm. In our model, we do not assume the 
existence of a separate noiseless feedback channel. Instead, 
the feedback signal from the destination, which is allowed 
to depend on the signal received so far, is transmitted over 
the same noisy channel used by the source. Based on the 
noisy feedback signal, the source can then causally adapt its 
transmission scheme, hoping to increase the perfect secrecy 
rate. The wiretapper receives a mixture of the signal from the 
source and the feedback signal from the destination. Quite 
interestingly, we show that in the modulo-additive DMC with 
a full-duplex destination, the perfect secrecy capacity with 
noisy feedback equals the capacity of the main channel in 
the absence of the wiretapper. Furthermore, the capacity is 
achieved with a simple scheme in which the source ignores the 
feedback signal and the destination feeds back randomly gen- 
erated symbols from a certain finite alphabet. This feedback 
signal plays the role of a private key, known only by the des- 
tination, and encryption is performed by the modulo-additive 
channel. The more challenging scenario with a half-duplex 
destination, which cannot transmit and receive simultaneously, 
is considered next. Here, the active transmission periods of 
the destination will introduce erasures in the feed-forward 



source-destination channel. In this setting, we propose a novel 
feedback scheme that achieves a positive perfect secrecy rate 
for any non-trivial channel distribution. The feedback signal 
in our approach acts as a private destination only key which 
strikes the optimal tradeoff between introducing erasures at 
the destination and errors at the wiretapper Overall, our 
work proposes a novel approach for encryption where 1) the 
feedback signal is used as a private key known only to the 
destination; and 2) the encryption is performed by exploiting 
the modulo-additive property of the channel. This encryption 
approach is shown to be significantly superior to the classical 
public discussion paradigm. 

The rest of the paper is organized as follows. In Section HH 
we introduce the system model and our notation. Section Hill 
describes and analyzes the proposed feedback scheme which 
achieves the capacity of the full duplex modulo-additive DMC. 
Taking the Binary Symmetric Channel (BSC) as an example, 
we then compare the performance of the proposed scheme 
with the public discussion approach. The half-duplex scenario 
is studied in Section |IV] Finally, Section |V] offers some 
concluding remarks and outlines possible avenues for future 
research. 

II. The Modulo-Additive Discrete Memoryless 
Channel 

The modulo-additive discrete memoryless wiretap channel 
is described by the following relations 

Yii)=X{i)+Ni{i), 
Z{t)=X{i) + N2{i), 

where, at time i ~ ,n, Y{i) is the received symbol 

at the destination, Z{i) is the received symbol at the wire- 
tapper, X{i) is the channel input, Ni{i) and N2{i) are the 
noise samples at the destination and wiretapper, respectively. 
Here Ni{i) and N2{i) are allowed to be correlated, while 
each process is assumed to be individually drawn from an 
independent and identically distributed source. Also we have 

x{i) e X ^ {o,ir-- Ax\ ^ i},Y{t),Ni{i) e y ^ 

{0,1,--- ,|3^|-l}andZ(i),iV2(i) eZ = {0,l,--- ,|Z|-1} 
with finite alphabet sizes \y\ and \Z\ respectively. Here 
'+' is understood to be modulo addition with respect to the 
corresponding alphabet size, i.e., Y{i) — [X{i) + Ni{i)] 
mod 13^1 and Z{i) = [X{i) + N2{i)] mod \Z\ with addition 
in the real field. 

In this paper, we focus on the wiretap channel with noisy 
feedback. More specifically, at time i the destination sends 
the causal feedback signal Xi{i) over the same noisy channel 
used for feed-forward transmission, i.e., we do not assume the 
existence of a separate noiseless feedback channel. The causal 
feedback signal is allowed to depend on the signal received 
to that point i.e., Xi{i) = ^i{Y'-~^), where ^ can be 

any (possibly stochastic) function. In general, we allow the 
destination to choose the alphabet of the feedback signal Xi 
and the corresponding size \Xi\. With this noisy feedback from 
the destination, the received signal at the source, wiretapper 
and destination are 

Yo{i) = X{i) + Xi{t) + No{i), 
Y{t)=X{i) + Xi{t) + Ni{i), 



and 

Z{i)=X{i)+Xi{i) + N2{i), 

respectively. Here Yo{i) e = {0, 1, • ' ' , |3^o| - 1} is the 
received noisy feedback signal at the source and No{i) is 
the feedback noise, which may be correlated with Ni{i) and 
N2{i)- We denote the alphabet size of No{i) and Yo{i) by |3^o|- 
Again, all '+' operation should be understood to be modulo 
addition with corresponding alphabet size. 

Now, the source wishes to send the message W £ W — 
{1, • • • , M} to the destination using an (Af, n) code consisting 
of: 1) a casual stochastic encoder / at the source that maps 
the message w and the received noisy feedback signal ?/g^^ to 
a codeword x G A"" with 

x{i) = f{i,w,yl~^), 

2) a stochastic feedback encoder at the destination that maps 
the received signal into Xi{i) with xi{i) = ^'(y*^^), and 3) a 
decoding function at the destination d: 3^" W. The average 
error probability of the {M, n) code is 

= H Ji^^^'^^^^ ^ w|w was sent}. 

tuGW 

The equivocation rate at the wiretapper is defined as 
Re = ^H{W\Z). 

We are interested in achievable perfectly secure transmission 
rates defined as follows. 

Definition 1: A secrecy rate is said to be achievable 
over the wiretap channel with noisy feedback if for any e > 0, 
there exists an integer n{e) and a sequence of codes (M, n) 
such that for all n > n{e), we have 

R^ = -logzM, (1) 
n 

Pe < (2) 

and 

-H{W\Z) > R^-e. (3) 
n 

Definition 2: The secrecy capacity with noisy feedback C| 
is the maximal rate at which messages can be sent to the 
destination with perfect secrecy; i.e. 

C/ — sup {i?-'^ : R-^ is achievable}. 

Note that in our model, the wiretapper is assumed to have 
unlimited computational resources and to know the coding 
scheme of the source and the feedback function used by 
the destination. We believe that our feedback model captures 
realistic scenarios in which the terminals exchange information 
over noisy channels. 

III. The Wiretap Channel with Full-Duplex 
Feedback 

A. Known Results 

The secrecy capacity of the wiretap DMC without feedback 
Cs was characterized in [2]. Specializing to our modulo- 
additive channel, one obtains 

- umx\I{V;Y)-I{V;Z)] + . (4) 



The wiretap DMC with pubUc discussion was introduced 
and analyzed in [3], [4]. More specifically, these papers 
considered a more general model in which all the nodes 
observe correlated variables ( The wiretap channel model is a 
particular mechanism for the nodes to observe the correlated 
variables, and corresponds to the "channel type model" studied 
in [4].), and there exists an extra noiseless public channel 
with infinite capacity, through which both the source and the 
destination can send information. Combining the correlated 
variables and the publicly discussed messages, the source and 
the destination generate a key about which the wiretap has 
negligible information. Please refer to [4] for rigorous defini- 
tions of these notions. Since the public discussion channel is 
noiseless, the wiretapper is assumed to observe a noiseless 
version of the information transmitted over it. It is worth 
noting that some of the schemes proposed in [3], [4] manage 
only to generate an identical secret key at both the source and 
destination. The source may then need to encrypt its message 
using the one-time pad scheme which reduces the effective 
source-destination information rate. Thus, the effective secrecy 
rate that could be used to transmit information from the source 
to the destination may be less than the results reported in [3], 
[4]. Nevertheless, we use these results for comparison purposes 
(which is thus generous to the public discussion paradigm). 
The following theorem gives upper and lower bounds on the 
secret key capacity of the public discussion paradigm Cf. 

Theorem 1 ( [3], [4]): The secret key capacity of the pub- 
lic discussion approach satisfies the following conditions: 

max{max[/(X; Y) - I{X; Z)], max[/(X; Y) - I{Y; Z)]} 

Px Px 

<CP < min{max/(X;r),max/(X;y|Z)}. 

Px Px 

Proof: Please refer to [3], [4]. ■ 
These bounds are known to be tight in the following 
cases [3], [4]. 

1) Pyz\x — Py\xPz\X7 the main channel and the 
source-wiretapper channel are independent; in this case 

CP = max{/(X;r)-/(r;Z)}. (5) 

Px 

2) Pxz\Y = Px\yPz\y, i-e., X ^ Y ^ Z forms a 
Markov chain, and hence the source-wiretapper channel 
is a degraded version of the main channel. In this case 

= max{/(X;y) (6) 

Px 

This is also the secrecy capacity of the degraded wire- 
tap channel without feedback. Hence public discussion 
does not increase the secrecy capacity for the degraded 
wiretap channel. 

3) PxY\z = Px\zPy\z, i.e., X ^ Z ^ Y, so that 
the main channel is a degraded version of the wiretap 
channel. In this case 

CP ^ 0. (7) 
Again, public discussion does not help in this scenario. 



B. The Main Result 

The following theorem characterizes the secrecy capacity of 
the wiretap channel with noisy feedback. Moreover, achiev- 
ability is established through a novel encryption scheme that 
exploits the modulo-additive structure of the channel and uses 
a private key known only to the destination. 

Theorem 2: The secrecy capacity of the discrete memory- 
less modulo-additive wiretap channel with noisy feedback is 

Cf = C, 

where C is the capacity of the main channel in the absence 
of the wiretapper 

Proof: (Sketch) For the converse part, we first upper 
bound the secrecy capacity with feedback by the channel 
capacity with feedback in the absence of the wiretapper, by 
ignoring the equivocation condition ([3]). Since feedback does 
not increase the channel capacity of the DMC, the channel 
capacity with feedback in the absence of the wiretapper is C, 
which completes the converse part. 

For the achievability part, we use the following novel 
scheme. The source ignores the feedback signal and uses a 
channel coding scheme for the ordinary channel without a 
wiretapper. The destination sets Xi = Z, and at any time i 
sets Xi{i) — a, where a is chosen randomly and equiprobably 
from {0, • • • , |Z| — 1}. Hence Xi is uniformly distributed over 
Z". After receiving Y, the destination first sets Y = Y — Xi, 
and then obtains an estimate of the codeword by finding an 
X that is jointly typical with Y. It can be shown that the 
error probability at the destination can be made arbitrarily 
small. The wiretapper receives Z = X + Xi + N2, which 
can be shown to be uniformly distributed over Z" for any 
realizations of X and N2. Hence I{X; Z) — 0, which further 
implies I{W; Z) = by the data processing inequaUty. 
Please refer to [5] for further details. ■ 
Our scheme achieves I{W; Z) — 0. This implies perfect 
secrecy in the strong sense of Shannon [6] as opposed to 
Wyner's notion of perfect secrecy [1], which has been pointed 
out to be insufficient for certain cryptographic applications [7]. 
The enabling observation behind our achievability scheme is 
that, by judiciously exploiting the modulo-additive structure 
of the channel, one can render the channel output at the 
wiretapper independent of the codeword transmitted by the 
source. Here, the feedback signal Xi serves as a private key 
and the encryption operation is carried out by the channel. 
Instead of requiring both the source and destination to know a 
common encryption key, we show that only the destination 
needs to know the encryption key, hence eliminating the 
burden of secret key distribution. Remarkably, the secrecy 
capacity with noisy feedback is shown to be larger than the 
secret key capacity of public discussion schemes. This point 
will be further illustrated by the binary symmetric channel 
example discussed next. This presents a marked departure 
from the conventional wisdom, inspired by the data process- 
ing inequality, which suggests the superiority of noiseless 
feedback. This result is due to the fact that the noiseless 
feedback signal is also available to the wiretapper, while in 
the proposed noisy feedback scheme neither the source nor 
the wiretapper knows the feedback signal perfectly. In fact. 



the source in our scheme ignores the feedback signal, which is 
used primarily to confuse the wiretapper. Our result shows that 
complicated feedback functions are not needed to achieve 
optimal performance in this setting (i.e., a random number 
generator suffices). Also, the alphabet size of the feedback 
signal can be set equal to the alphabet size of the wiretapper 
channel and the coding scheme used by the source is the same 
as the one used in the absence of the wiretapper. 

C. The Binary Symmetric Channel Example 




Fig. 1. The Binary Symmetric Wiretap Channel. 

To illustrate the idea of encryption over the channel, we 
consider in some details the wiretap BSC shown in Figure [T] 
where X ^ y = Z = Vx{Nx{i) = 1} = e and 

Pr{^2(*) = 1} = (5. The secrecy capacity of this channel 
without feedback is known to be [3] 

C. = [H{6)-H{e)] + , 

with H{x) = — xlogx — [1 — x) log(l — x). We differentiate 
among the following special cases. 

1) £ = ,5 = 0. 

In this case, both the main channel and wiretap channel 
are noiseless, hence = 0. Also we have Cf = 0, 
since the wiretapper sees exactly the same as what the 
destination sees. Specializing our scheme to this BSC 
channel, at time i, the destination randomly chooses 
Xi{i) = 1 with probability 1/2 and sends Xi{i) over 
the channel. This creates a virtual BSC at the wiretapper 
with 5 =1/2. On the other hand, since the destination 
knows the value of Xi{i), it can cancel it by adding 
to the received signal. This converts the original 
channel to an equivalent BSC with e = 0. Hence, 
through our noisy feedback approach, we obtain an 
equivalent wiretap BSC with parameters e = and 
5' = 1/2 resulting in C/ = H{5') - H{t) = 1. 

2) < (5 < e < 1/2, Ni{i) and N2{i) ai-e independent. 
Since (5 < e, we have Cg = 0. Also, Ni{i) and A^2(*) 
independent, so Pyz\x — Py\xPz\x- Then from (|5]l, 
one can easily obtain that [3] Cf = H{e + 5 — 2eS) — 
Hie). 

Our feedback scheme, on the other hand, achieves C/ = 
1 - H{e). Since H{e + S- 2e(5) < 1, we have C/ > Cf 
with equality if and only if e + 6 — 2e5 = 1/2. 



3) < (5 < e < 1/2 and Ni{i) = N2{i) + N {i), where 
Pr{iV'(i) = 1} = (e - 5)/{l - 25). 
The main channel is a degraded version of the source- 
wiretapper channel, X ^ Z ^ Y, as shown in Figure |2] 



X Z Y 




Fig. 2. The BSC Wiretap Channel with a Degraded Main Channel. 

Hence, from (Hi, we have = Cf = 0, while C/ = 
1-H{e). 

4) < e < (5 < 1/2, and N2{i) = Ni{i) + N (i), where 
Pr{7V'(z) = l} = (5-e)/(l-2e). 



X Y Z 




Fig. 3. The BSC wiretap Channel with a Degraded Source-Wiretapper 
Channel. 

In this case, the source-wiretapper channel is a degraded 
version of the main channel as shown in Figure |3j X 
y -> Z, so from dg = Cf = H{S) - H{e). But 
C/ = 1 - iJ(e) > CP with equality if and only if 
S = 1/2. 

5) Ni{i) and N2{i) are correlated and the channel is not 
degraded. 

In this case Cs = [H{S) - H{e)]+. The value of Cf is 
unknown in this case but can be bounded by 

= [H{6) - Hie)]+ <CP<1- Hie) = C/. 

In summary, the secrecy capacity with noisy feedback is 
always larger than or equal to that of the public discussion 
paradigm when the underlying wiretap channel is a BSC. More 
strongly, the gain offered by the noisy feedback approach, over 
the public discussion paradigm, is rather significant in many 
relevant special cases. 

IV. Even Half-duplex Feedback is Sufficient 

It is reasonable to argue against the practicality of the full 
duplex assumption adopted in the previous section. For exam- 
ple, in the wireless setting, nodes may not be able to transmit 
and receive with the same degree of freedom due to the large 
difference between the power levels of the transmit and receive 
chains. This motivates extending our results to the half duplex 
wiretap channel in which the terminals can either transmit or 
receive but never both at the same time. Under this situation, 
if the destination wishes to feed back at time i, it loses 
the opportunity to receive the i*'* symbol transmitted by the 
source, which effectively results in an erasure (assuming that 
the source is unaware of the destination's decision). The proper 
feedback strategy must, therefore, strike a balance between 
confusing the wiretapper and degrading the source-destination 



link. In order to simplify the following presentation, we first 
focus on the wiretap BSC. The extension to arbitrary modulo- 
additive channels is briefly outlined afterwards. 

In the full-duplex case, at any time i, the optimal scheme is 
to let the destination send Xi («), which equals or 1 equiprob- 
ably. But in the half-duplex case, if the destination always 
keeps sending, it does not have a chance to receive information 
from the source, and hence, the achievable secrecy rate is zero. 
This problem, however, can be solved by observing that if at 
time i, Xi{i) — 0, the signal the wiretapper receives, i.e., 
Z{i) = Xi{i) + N2{i), is the same as in the case in which 
the destination does not transmit. The only crucial difference 
in this case is that the wiretapper does not know whether the 
feedback has taken place or not, since Xi{i) can be randomly 
generated at the destination and kept private. 

The previous discussion inspires the following feedback 
scheme for the half-duplex channel. The destination first fixes 
a value t G [0,1] which is revealed to both the source and 
wiretapper. At time i, the destination randomly generates 
Xi{i) = 1 with probability t and Xi{i) = with probability 
1 — 1 If Xi{i) = 1, the destination sends Xi{i) over the 
channel, which causes an erasure at the destination and a 
potential error at the wiretapper. On the other hand, when 
Xi{i) = 0, the destination does not send a feedback signal 
and spends the time on receiving from the channel. The key 
to this scheme is that although the source and wiretapper 
know t, neither is aware of the exact timing of the event 
{Xx{i) = 1}. The source ignores the feedback and keeps 
sending information. The following result characterizes the 
achievable secrecy rate with the proposed feedback scheme. 

Theorem 3: For a BSC with half-duplex nodes and param- 
eters e and 6, the scheme proposed above achieves 

i?f = max [(1 - t) [H{e + n - 2iie) - H{e)] - 

[H{6 + ^x-2fx6)-H{6)]Y , 

with 5 = 5 + t- 2St. 

In general, one can obtain the optimal values of /i and t by 
setting the partial derivatives of R-^, with respect to fj, and t 
to 0, and solving the corresponding equations. Unfortunately, 
except for some special cases, we do not have a closed form 
solution for these equations at the moment. Interestingly, using 
the not necessarily optimal choice of /i = t = 1/2, we 
obtain = [1 — H{e)]/2 implying that we can achieve 
a nonzero secrecy rate as long as e ^ 1/2 irrespective 
of the wiretapper channel conditions. Hence, even for half- 
duplex nodes, noisy feedback from the destination allows for 
transmitting information securely for almost any wiretap BSC. 
Finally, we compare the performance of different schemes in 
some special cases of the wiretap BSC. 

1) e = S = 0. 

As mentioned above, here we have Cg = = 0. It 
is easy to verify that the optimal choice of /x and t are 
1/2, and we thus have R{ = 1/2. 

2) < (5 < e < 1/2 and Ni{i) = N2{i) + N' (i), where 
Pr{7V'(0 = l} = (6-(5)/(l-2<5). 

The main channel is a degraded version of the wiretap 
channel, so Cg = = 0. But by setting jj, = t = 1/2 



in our half-duplex noisy feedback scheme, we obtain 

Rf = [1 - H{e)]/2. 
The extension to the general discrete modulo-additive chan- 
nel is natural. The destination can set Xi = Z, and generates 
Xi{i) with a certain distribution Pxi- At time i, if the ran- 
domly generated Xi{i) ^ 0, the destination sends a feedback 
signal, incurring an erasure to itself. On the other hand, if 
Xi{i) = 0, it does not send the feedback signal and spends 
the time listening to the source. The achievable performance 
could be calculated based on the equivalent channels as done 
in the BSC. This scheme guarantees a positive secrecy capacity 
as seen in the case where Pxi is chosen to be uniformly 
distributed over Z. This is because a uniform distribution over 
Z renders the output at the wiretapper independent from the 
source input, i.e., I{W\ Z) = 0, while the destination can still 
spend 1/\Z\ part of the time Ustening to the source. Finding 
the optimal distribution Px^, however, is tedious. 

V. Conclusion 

In this paper, we have obtained the secrecy capacity (or 
achievable rate) for several instantiations of the wiretap chan- 
nel with noisy feedback. More specifically, with a full duplex 
destination, it has been shown that the secrecy capacity of 
modulo-additive channels is equal to the capacity of the 
source-destination channel in the absence of the wiretapper. 
Furthermore, the secrecy capacity is achieved with a simple 
scheme in which the destination randomly chooses its feed- 
back signal from a certain finite alphabet. Interestingly, with 
a sUghtly modified feedback scheme, we are able to achieve 
a positive secrecy rate for the half duplex channel. We have 
shown that this paradigm significantly outperforms the public 
discussion approach for sharing private keys between the 
source and destination. Our results motivate several interesting 
directions for future research. For example, characterizing the 
secrecy capacity of arbitrary DMCs (and the AWGN channel) 
with feedback remains an open problem. From an algorithmic 
perspective, it is also important to understand how to exploit 
different channel structures (in addition to the modulo-additive 
one) for encryption purposes. Finally, extending our work to 
multi-user channels (e.g., the relay-eavesdropper channel [8]) 
is of considerable interest. 

References 

[1] A. D. Wyner, "Tlie wire-tap channel," Bell System Technical Journal, 

vol. 54, no. 8, pp. 1355-1387, 1975. 
[2] I. Csiszar and J. Korner, "Broadcast channels with confidential messages," 

IEEE Trans, on Information Theory, vol. 24, pp. 339-348, May 1978. 
[3] U. M. Maurer, "Secret key agreement by public discussion from common 

information," IEEE Trans, on Information I'heory, vol. 39, pp. 733-742, 

May 1993. 

[4] R. Ahlswede and I. Csiszar, "Common randomness in information theory 

and cryptography, part I: Secret sharing," IEEE Trans, on Information 

Theory, vol. 39, pp. 1121-1132, July 1993. 
[5] L. Lai, H. El Gamal, and H. V. Poor, "The wiretap channel with feedback: 

Encryption over the channel," IEEE Trans, on Information Theory, Apr. 

2007. Submitted. 

[6] C. E. Shannon, "Communication theory of secrecy systems," Bell System 

Technical Journal, vol. 28, pp. 656-715, Oct. 1949. 
[7] U. M. Maurer and S. Wolf, "Information-theoretic key agreement: From 

weak to strong secrecy for free," Lecture Notes in Computer Science, 

vol. 1807, pp. 356-373, 2000. 
[8] L. Lai and H. El Gamal, "The relay-eavesdropper channel: Cooperation 

for secrecy," IEEE Trans, on Information Theory, Dec 2006. Submitted. 



